Privacy Policy
Version v1.3.0 · Last updated: 9 October 2026
This privacy policy explains how Legit AI Oy processes personal data on the Haavi website (www.haavi.ai), in the Haavi app (app.haavi.ai) and in the Haavi browser extension.
We comply with the requirements of the EU General Data Protection Regulation (GDPR) in processing personal data. This policy covers website use, the contact and registration forms, use of the Haavi app, and use of the Haavi browser extension.
By using our website or our app, you agree that we process your data as described in this policy.
Data controller contact information
The data controller (the party responsible for processing your personal data) is Legit AI Oy, which operates the Haavi website and the Haavi app.
Legit AI Oy, business ID 3415277-4. Address: Fleminginkatu 10 A 1, 00530 Helsinki, Finland.
Contact person: Aku Nikkola. Email: aku@haavi.ai. Phone: +358 40 571 2966. You can send all privacy-related inquiries and requests to the above email address.
Personal data we collect
We collect the following personal data. Some of it is collected only on the website and some only in the Haavi app or the browser extension.
- Name and contact details: name, email address, phone number and job title.
- Company information: name, business ID, website, description, industry, revenue and number of employees.
- User account details and login credentials (Haavi app).
- Information you submit through forms: the contact and registration forms and the newsletter subscription.
- Procurement material you process in the app: tender documents, bid history, qualifications and references.
- Data from the Haavi browser extension: the address, title and text of the tender page you have open on Tarjouspalvelu or Hilma, and the messages you write in the extension. See the section on the Haavi browser extension below.
- Technical data: IP address, browser information, and usage and log data.
Haavi browser extension
The Haavi browser extension for Chrome works on the public tender portals Tarjouspalvelu (tarjouspalvelu.fi) and Hilma (hankintailmoitukset.fi). It lets you use the Haavi app's AI assistant next to the tender you have open. You sign in to it with your Haavi app account.
When you use the extension, it sends the following data to the Haavi app, where it is processed and stored like your other Haavi AI conversations:
- The address, title and text of the tender page you have open on Tarjouspalvelu or Hilma, including the tender form's questions and the answers already entered in it.
- The messages you write in the extension.
- The outcome of the form fills you approve: which fields were filled in and which could not be.
Data stored in your browser
The extension keeps your Haavi sign-in session in the browser's extension storage. The session is deleted when you close the browser or remove the extension.
What the extension does not do
- It does not read the content of other websites. It only checks the address of the active tab to see whether you are on Tarjouspalvelu or Hilma.
- It does not track your browsing, and it does not send the addresses of other websites to Haavi.
- It never submits a tender on your behalf. It fills in only the form fields you have reviewed and approved.
- It does not sell the data or use it for advertising. AI processing uses the service providers listed in the section on personal data sharing and transfers.
Purposes of processing
We process personal data only for predefined purposes.
- Service provision and user account management: We process your data to provide the service, maintain user accounts, and offer customer support.
- Handling enquiries and registrations: We process the data you give through our forms in order to respond to you.
- Communication and information: We use contact information to communicate with you about service-related matters. We request separate consent for marketing messages and the newsletter.
- Website and app development and analytics: Technical data and cookie-collected data are used to monitor and improve service usage.
- Security and abuse prevention: Personal data may be processed to secure the website, the app and user information.
- Legal obligations: We process personal data to fulfil our statutory obligations.
Legal bases for processing
We process personal data on the following legal bases under the GDPR.
- Performance of a contract: maintaining your user account and providing the service to you or the organisation you represent.
- Consent: marketing communications, the newsletter subscription and analytics cookies.
- Legitimate interest: responding to enquiries, service development, security and abuse prevention.
- Legal obligation: accounting legislation and other statutory obligations that bind us.
Personal data retention periods
We retain personal data only as long as necessary to fulfil the described purposes or as required by law.
- User account data is retained as long as you have an active user account. After account deletion, data is deleted or anonymised within 30 days.
- Enquiry and registration data is retained as long as it is needed to handle your enquiry and to prepare a possible customer relationship. We delete the data once the matter is handled and no customer relationship is formed.
- Newsletter subscriber data is retained until you unsubscribe.
- Website analytics data is collected in aggregate form and cannot identify an individual user.
- Accounting-related data is retained for up to 6 years in accordance with accounting legislation.
- You can delete your user account and the data related to it yourself at any time in the Haavi app settings. You can also request deletion by contacting us.
Personal data protection
The security of your personal data is important to us. We use appropriate technical and organisational measures to prevent unauthorised access to data.
All connections are encrypted with TLS and data is also encrypted at rest. Other measures include firewalls, secure server connections, access control and regular security audits.
Only personnel who need access for their duties can process personal data, and they are bound by confidentiality obligations.
Personal data sharing and transfers
We do not sell, rent, or otherwise disclose your personal data to external third parties for marketing purposes. We share personal data with external parties only in the following situations:
- Service provision: we use the service providers listed below, who process personal data on our behalf.
- Legal obligations: We may disclose personal data to authorities when required by law.
- Corporate transactions: If our business is sold or merged, data may be transferred as part of the transaction.
Third-party service providers
We use the following service providers, who process personal data on our behalf:
| Service provider | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Database, user management, and storage of form and enquiry data | All user and company data, form data | EU | Data stays within the EU |
| Vercel | Website and app hosting, and website usage analytics | IP address, usage data | EU | Data stays within the EU |
| Amazon Web Services (Bedrock) | AI processing in the Haavi app | User inputs, conversation history, company information, procurement material | EU | Data stays within the EU |
| Upstash | Rate limiting to protect the service | User identifier (stored temporarily, deleted within minutes) | EU | Data stays within the EU |
| Lettermint | Email messages from the Haavi app, and website enquiry and registration notifications | Name, email address, company name, message content | EU | Data stays within the EU |
| Sentry | Error tracking and technical monitoring | IP address, error logs, technical data | EU | Data stays within the EU |
| Stripe | Payment processing | Name, email, payment details | USA | SCCs + EU-US Data Privacy Framework |
| Slack | Slack integration, when you enable it | Message content, Slack user and workspace identifiers | USA | SCCs + EU-US Data Privacy Framework |
| Microsoft | Single sign-on (Microsoft Entra ID) | Name, email address, profile identifiers | USA | SCCs + EU-US Data Privacy Framework |
| Single sign-on (Google) | Name, email address, profile identifiers | USA | SCCs + EU-US Data Privacy Framework |
International data transfers
Personal data is transferred to the United States by the service providers marked USA in the table above: Stripe, Slack, Microsoft and Google.
Transfers are protected by EU Standard Contractual Clauses (SCCs) and/or EU-US Data Privacy Framework certification. You can request a copy of the Standard Contractual Clauses by contacting aku@haavi.ai.
Use of cookies
We use cookies and similar technologies. A cookie is a small text file that your browser stores. We use the following cookies:
- Necessary cookies: they manage login and your session in the Haavi app, and access to protected pages. The service does not work without them.
- Functional cookies: they store your language choice for one year.
- Usage analytics: we collect information about website usage for service development. We enable analytics only after you have accepted it in the cookie banner.
- Security cookies: they protect the connection to an external service, for example Slack. The service deletes them after use.
Managing cookies
You can accept or decline analytics cookies in the cookie banner shown on the website. Your choice is stored in your browser, and you can change it by clearing your browser data.
You can also delete or block cookies in your browser settings. If you block necessary cookies, you cannot log in to the Haavi app.
User rights
As a user, you have privacy rights that allow you to influence the processing of your personal data. We provide all GDPR-compliant rights:
- Right of access: The right to confirm whether we process your personal data and to request a copy of your data.
- Right to rectification: The right to request correction of inaccurate or incomplete data.
- Right to erasure: The right to request deletion of your personal data in certain circumstances.
- Right to restriction: The right to request restriction of processing in certain circumstances.
- Right to object: The right to object to processing based on your particular personal situation.
- Right to data portability: The right to receive your data in a structured, machine-readable format.
- Right to withdraw consent: The right to withdraw your consent at any time.
- Right to lodge a complaint: The right to file a complaint with the Data Protection Ombudsman's Office.
Privacy policy changes and updates
We may periodically update this privacy policy to reflect changing practices, legislation, or service features.
Every version has a version number, and the date at the top of this page shows the last update. If we make material changes, we will notify users and ask Haavi app users for their consent again.
Contact us
If you have any questions about this privacy policy, Haavi's security, or other Haavi-related matters, please don't hesitate to contact us:
Aku Nikkola, Founder – aku@haavi.ai